KR102041545B1 - Event monitoring method based on event prediction using deep learning model, Event monitoring system and Computer program for the same - Google Patents

Abstract

The present invention relates to an event monitoring method, event monitoring system, and computer program based on event prediction using a deep learning model. According to an embodiment of the present invention, disclosed are an event monitoring method, event monitoring system, and computer program based on event prediction using a deep learning model, which are configured to select, by a plurality of object elements, a main event and a preceding event temporally preceding the main event based on a criterion predetermined from a work system combined based on hierarchical relationship, learn a deep learning model using the selected events, and predict and determine the main event by inputting a plurality of pieces of event information generated in a real-time monitoring process into the deep learning model.

Description

Event monitoring method based on event prediction using deep learning model, Event monitoring system and computer program for the same}

The present invention relates to an event monitoring method, an event monitoring system, and a computer program based on event prediction using a deep learning model. In detail, a plurality of object elements are combined based on a hierarchical relationship to pre-set criteria from a work system. Based on the main events and the preceding events in time, the deep learning model is trained using the selected events, and the event information generated in the real-time monitoring process is input to the deep learning model. The present invention relates to an event monitoring method, an event monitoring system, and a computer program based on an event prediction using a deep learning model configured to predict a major event.

IT services (tasks) are provided to users through business systems that combine various IT infrastructures (eg servers / networks / storages) and IT applications (eg WAS / WEB / DBMS / other applications, etc.).

The IT infrastructure or IT applications that make up a business system include a plurality of object elements, each of which is combined based on a hierarchical relationship.

FIG. 11 is a schematic diagram illustrating an event occurrence structure of a work system and illustrates a correlation between a service (work) provided by the work system and a physical component and / or a logical component of the system.

Referring to FIG. 11, one service is composed of one or more unit tasks, and each unit task is included in various physical object elements included in physical elements such as server / storage and logical elements such as WEB / WAS / DB. The functions of various logical object elements are provided in combination.

For example, in a physical functional element of a system such as CPU, memory, etc., overloading of CPU or memory availability may affect other functional elements of the work system and result in system failure.

As another example, in a logical functional element of a system such as a process, session, log, etc., if a crash occurs during process processing or an error occurs during session processing, it may affect other functional elements of the business system and consequently cause system failure. Can be.

FIG. 12 is a schematic diagram illustrating an event occurrence structure of a work system, and illustrates an individual event occurring for each object element constituting the work system and a composite event generated by an association or interaction of two or more individual events.

However, in the related art, in order to monitor the risk of failure of a business system, it was common to detect through individual events occurring for each object element.

However, a major event (critical or major level event) that may pose a critical risk to a business system may be caused by one individual event due to one object element, but two or more individuals due to two or more object elements Since events often occur through physical or logical interactions or associations, monitoring of individual events has limited the prediction of major events.

Republic of Korea Patent Registration 10-1648272 (registered 08/08/2016) Republic of Korea Patent Registration 10-1637458 (July 01, 2016 registration) Republic of Korea Patent Registration 10-1919076 (November 09, 2018 registration) Republic of Korea Patent Registration 10-1917006 (November 2, 2018 registration)

SUMMARY OF THE INVENTION The present invention has been made in view of the above-described problems, and selects a main event and a preceding event in time based on a predetermined criterion from a work system in which a plurality of object elements are combined based on a hierarchical relationship. The deep learning model is trained using selected events, and the deep learning model is configured to input a plurality of event information generated during the real-time monitoring process into the deep learning model to predict and predict the major events. An object of the present invention is to provide a prediction based event monitoring method, an event monitoring system, and a computer program.

According to an aspect of the present invention in consideration of the above object, as an event monitoring method to be executed in a monitoring system interworking with a work system-the work system is a plurality of object elements are combined based on a hierarchical relationship and at least one task Providing a service; 1) obtaining event information of an individual event occurring in the work system, and storing the event information in the form of time series data based on an occurrence time of the individual event; Object element information indicating which object element of the hierarchical association has occurred and rating information assigned according to a severity state of the individual event; 2) extracting, from the time series data of the event information, a main event for learning a deep learning model based on a preset extraction criterion; 3) extracting, from the time series data of the event information, at least one or more individual events that temporally precede one of the main events based on preset extraction criteria as a preceding event for one of the main events; 4) training a deep learning model using event information of the preceding event as input data and event information of the main event as output data; And 5) using the event information of the individual events occurring in real time in the work system as input data of the deep learning model and predicting the likelihood of occurrence of a major event from the output data of the deep learning model. Disclosed is an event monitoring method based on event prediction.

According to another aspect of the invention, a memory for storing one or more instructions; And a processor that executes the one or more instructions stored in the memory, wherein the processor obtains event information of individual events occurring in a business system and converts the event information into time series data form based on an occurrence time of the individual events. The business system is configured to provide a plurality of object elements in which a plurality of object elements are combined based on the hierarchical association and provide at least one business service, wherein the event information indicates that the individual event Object element information indicating whether an occurrence has occurred, and grade information assigned according to a severity state of the individual event; and, from the time series data of the event information, learning of a deep learning model is performed based on a predetermined extraction criterion. Extracts a major event for the event information From the series data, at least one or more individual events that temporally precede one of the main events based on preset extraction criteria are extracted as a preceding event for one of the main events, and event information of the preceding event is input data. And learn the deep learning model using the event information of the main event as output data, and use the event information of the individual event occurring in real time in the work system as the input data of the deep learning model and the main event from the output data of the deep learning model. Disclosed is an event monitoring system characterized by predicting the likelihood of occurrence.

According to another aspect of the present invention, a computer program stored in a medium in combination with hardware to execute an event monitoring method, wherein the monitoring method obtains event information of an individual event occurring in the business system, Storing the event information in the form of time series data based on an occurrence time, wherein the business system is configured to provide a plurality of object elements in which a plurality of object elements are combined based on a hierarchical relationship and provide at least one business service. Object element information indicating at which object element of the hierarchical association the individual event occurred and rating information assigned according to the severity state of the individual event; Extracting, from the time series data of the event information, a main event for learning a deep learning model based on a preset extraction criterion; Extracting, from the time series data of the event information, at least one or more individual events that temporally precede one of the main events based on preset extraction criteria as a preceding event for one of the main events; Training a deep learning model using event information of the preceding event as input data and event information of the main event as output data; And using the event information of the individual events occurring in real time in the work system as input data of the deep learning model and predicting the probability of occurrence of the main event from the output data of the deep learning model. This is disclosed.

As described above, the present invention provides a business system in which a plurality of object elements are combined based on a hierarchical relationship. Furthermore, in order to monitor individual events occurring for each object element, a plurality of event elements may be generated based on a relationship. The advantage is that the main event can be predicted and judged.

1 is a connection diagram of a monitoring system according to an embodiment of the present invention;
2 is a block diagram of a monitoring system according to an embodiment of the present invention;
3 is a schematic diagram of a hardware perspective of a monitoring system according to an embodiment of the present invention;
4 is a schematic diagram for explaining a monitoring method according to an embodiment of the present invention;
5 is a schematic diagram for explaining a hierarchical relationship of a work system according to an embodiment of the present invention;
6 to 8 are schematic diagrams for explaining a process of extracting input data and output data for learning a deep learning model according to an embodiment of the present invention;
9 is a schematic diagram for explaining a learning process of a deep learning model according to an embodiment of the present invention;
10 is a schematic diagram for explaining an event monitoring process according to an embodiment of the present invention;
11 to 12 are schematic diagrams for explaining the event generation structure of the work system.

The present invention can be embodied in many other forms without departing from the spirit or main features thereof. Therefore, the embodiments of the present invention are merely examples in all respects and should not be interpreted limitedly.

The terms first, second, etc. are used only for the purpose of distinguishing one component from other components. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component.

When a component is said to be "connected" or "connected" to another component, it may be directly connected or connected to that other component, but there may be other components in between.

As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. In the present application, the terms "comprise", "comprise", "have" and the like are intended to express the presence of a component described in the specification or a combination thereof, and indicate the possibility that another component or feature is present or added. It is not excluded in advance.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a monitoring system according to an embodiment of the present invention, Figure 2 is a block diagram of a monitoring system according to an embodiment of the present invention, Figure 3 is a hardware of the monitoring system according to an embodiment of the present invention It is a schematic diagram of the point of view.

The monitoring system 20 according to an embodiment of the present invention obtains event information of individual events occurring in the work system 10 in various fields such as finance / public / manufacturing / communication, and time-series data analysis and analysis of the event information. By predicting one or more individual events that two or more individual events occur through physical or logical interactions or associations.

When another individual event occurs due to the interaction or association of two or more other individual events, such another individual event may be viewed as a complex event in which two or more causes are combined in view of the cause of occurrence.

The business system 10 is configured by combining various IT infrastructures (eg, servers / networks / storages, etc.) and IT applications (eg, WAS / WEB / DBMS / other applications, etc.) as illustrated in FIGS. 11 to 12. .

In addition, the IT infrastructure or IT application constituting the business system 10 includes a plurality of object elements, each of which is combined based on a hierarchical relationship.

The plurality of object elements may be physical function elements of the system such as CPU, memory, and the like, and may be logical function elements of the system such as processes, sessions, logs, and the like.

Particularly, in the present embodiment, the composite event having the grade information given according to the severity state of the composite event more than a predetermined level is defined as the main event, and the monitoring system 20 of the present embodiment defines the occurrence patterns of the individual events and the main event. The deep learning model is used to predict and predict key events.

In the deep learning model of the present embodiment, various known artificial neural network models may be applied, but a model based on a long short memory network (LSTM) architecture is preferably applied.

Long Short Memory Networks (LSTM) model is a kind of Recurrent Neural Networks (RNNs) among artificial neural network models, which is difficult to learn due to vanishing gradient problem. Loss is a proposed model to solve the problem, and is suitable as a deep learning model for learning data that changes over time, such as time-series data. Since the individual events of the present embodiment are stored as time series data based on the occurrence time and the grade information, deep learning learning is performed, and thus, the LSTM model can be particularly suitably monitored.

From a functional point of view, the monitoring system 20 of this embodiment, as shown in FIG. 2, monitors the occurrence of individual events and also predicts the occurrence of major events from the output data of the deep learning model and provides prediction results. Monitoring module 25, event data management module 26 for obtaining and storing individual events generated in work system 10 and storing them as time series data, and executing input data / output data generation and management functions for learning deep learning models. Each of the system elements constituting the learning data management module 27, the deep learning module 28 for executing the learning for predicting the occurrence of the main event and outputting the main event prediction result for the real time monitoring, and the work system 10 Affinity management module 29 for setting and managing hierarchical affinity of related events and event management items accordingly It is configured by.

In addition, the monitoring system 20 includes an event DB 21 for storing time series data of event data generated by the work system 10 and learning data DB 22 for storing training data for learning a deep learning model. It may be provided.

The monitoring system 20 can be provided with a display means 24. The display means 24 may be a normal monitor (or TV), and may be configured to display areas divided on one monitor or display a plurality of monitors as a single screen by interlocking with each other.

Referring to FIG. 3, from a hardware point of view, the monitoring system 20 of the present embodiment includes a memory 2 storing one or more instructions and a processor 4 executing the one or more instructions stored in the memory 2. And a computer program stored in the medium for executing the monitoring method. The monitoring system 20 of the present embodiment may include a data input / output interface 6, a communication interface 8, data display means 3, and data storage means 5.

The monitoring system 20 of the present embodiment may be implemented as an independent system interworking with the work system 10 through a network, or may be implemented as a modular system embedded in the work system 10 to interwork.

5 is a schematic diagram for explaining a hierarchical relationship of a work system according to an embodiment of the present invention.

The work system 10 of the present embodiment is configured by combining a plurality of object elements based on hierarchical relationships and providing at least one work service.

The object element may be either a physical function element (eg, CPU, memory, etc.) or a logical function element (eg, process, session, log, etc.) in which an individual event occurs.

The hierarchical relation may be defined as a tree structure in which the business system 10 is the highest hierarchy and the object element is the lowest hierarchy.

For example, in the case of FIG. 5, the work system 10 of the highest layer providing the work service includes a server group, a DB (Database) group, a MW (Middleware) group, etc. that provide detailed services constituting the work service. It is composed. Although not shown, it may further include a network group, a storage group, and the like.

For example, the server group includes the asvr_linux1 application and the asvr_linux2 application that execute the functions of the detailed service. The DB (Database) group or the Middleware (MW) group is similarly configured to include each application.

The asvr_linux1 application consists of object elements including CPU, memory, session, log, etc. that execute the application's functions physically or logically.

For example, the functions of one or more object elements are executed to execute the functions of one application, the detailed service functions of one group are executed by the execution of the functions of one or more applications, and the detailed service of one or more groups is executed. Business services are provided.

Due to this hierarchical association, when individual events occur in one or more object elements, another individual event may be generated by the interaction or association of these individual events.

For example, the individual event may be regarded as a state in which a severity is detected by a predetermined class criterion such as a CPU utilization state, a memory utilization state, a business process state, a service response state, and a session error state. Each individual event may be graded according to a preset criteria and severity state, and a state that has not reached a lower threshold may be classified as a NO event state or a NORMAL data state.

The monitoring system 20 of the present embodiment predicts and determines the main event generated by two or more individual events occurring for each object element based on the correlation.

4 is a schematic diagram illustrating a monitoring method according to an embodiment of the present invention, Figures 6 to 8 is a process for extracting input data and output data for learning a deep learning model according to an embodiment of the present invention 9 is a schematic diagram illustrating a learning process of a deep learning model according to an embodiment of the present invention, and FIG. 10 is a schematic diagram illustrating an event monitoring process according to an embodiment of the present invention.

In step 1), the monitoring system 20 obtains event information of individual events occurring in the work system 10 and stores the event information in the form of time series data based on the occurrence time of the individual events.

The event information includes object element information indicating in which object element of the hierarchical association the individual event occurs and grade information assigned according to a severity state of the individual event.

For example, event information of an individual event may be generated by an event collection agent installed in or in association with each server group or application. The event collection agent collects the state of object elements such as CPU utilization status, memory utilization status, business process status, service response status, session error status, records the collected time information, and assigns event class based on preset criteria. can do.

As another example, the event collection agent collects the state of the object element, records and transmits the collected time information, and the monitoring system 20 that receives the information gives an event class based on a preset criterion and sends the event information. You can also create

Preferably, the event information is stored in the form of time series data based on a preset period (eg, seconds / minute). 6 to 10 illustrate that event information is stored in the form of time series data every one minute.

In step 2), the monitoring system 20 extracts, from the time series data of the event information, a main event for learning a deep learning model based on a preset extraction criterion.

The criterion for extracting the main event is set to extract, as a main event, an individual event having class information of a predetermined level or more from among individual events included in time series data of the event information.

In the embodiment of Figures 6 to 10, the overall event grade is configured to increase in the order of normal-warning-minor-major-critical grade from low to high severity, and set to extract more than major grade as a major event.

In the following description, an event (A business process down) occurring at 16:38 in FIG. 6 is illustrated as a main event.

In step 3), the monitoring system 20 advances, from the time series data of the event information, at least one individual event that precedes one major event in time based on a predetermined extraction criterion for one major event. Extract as event.

The criterion for extracting the preceding event occurs in a preset time range based on the occurrence time of one main event extracted in step 2) among the individual events included in the time series data of the event information, and is also set in a predetermined grade. It is set to extract individual events having the above grade information (eg, above the warning grade) as the preceding event for the corresponding main event. The normal level can be considered as a normal state without an event, so it is excluded from the preceding event extraction.

Preferably, the preceding time range is set to a time range having a preset time interval based on the occurrence time of the main event. The reason for setting the time gap is to predict the occurrence of the main event in advance and to prevent or respond to the main event in advance based on the occurrence pattern of the individual event (predecessor event). This is to secure a time for preventing or responding by giving a time gap for the purpose. Depending on the monitoring policy, the time interval may be set to a time suitable for event prevention or response, or may be set so that there is no time interval.

6 illustrates a case where the preceding time range is set to 1 hour and the preset time interval is set to 30 minutes. That is, since the event (A business process down) occurring at 16:38 is extracted as the main event, a time interval of 30 minutes is given, and the preceding time range is set to 15:08 to 16:08.

Therefore, in the embodiment of FIG. 6, three individual events occurring at 15:26, 15:46, and 16:05 are included in the preceding time range 15:08 to 16:08, and the predetermined level or more (warning level or more) Since it is an individual event with class information, it is extracted as a preceding event for the main event.

Individual events that occur at 15:05, 16:25, and 16:35 are individual events that occurred outside the preceding time range of 15: 08 ~ 16: 08, so they are not extracted as preceding events even if they are above the warning level.

The above described configuration is illustrated in tables T1 and T2 of FIG. 6.

In step 4), the monitoring system 20 trains the deep learning model using the event information of the preceding event as input data and the event information of the main event as output data.

The input data is generated by generating a numerical event index value based on the object element information and the grade information included in the event information of the preceding event, and normalizing the event index value.

Preferably, the total items and the number of individual events to be monitored in the work system 10 are preset.

Referring to the example configuration of FIG. 7, the work system 10 of the present embodiment is set to monitor a total of 100 individual events, and is assigned an event management item which is a unique identification number for each individual event.

In addition, each event management item is assigned a priority ranking in consideration of the severity of the system. Each event management category has a priority ranking of 1st to 100th because the rankings compare the severity of 100 individual events in total. The above described configuration is illustrated in the table IT of FIG. 7.

The individual events of each event management item are classified into five grades of normal-warning-minor-major-critical grades according to their severity. The normal grade is regarded as the normal state where no event occurs and the event index value is '0'. In this case, one numerical value within the range of 1 to 400 can be assigned to the event index value for each class of the individual events included in the embodiment of FIG. 7. According to the monitoring policy, the total number of event management items or the priority ranking may be appropriately set. Accordingly, the total number of event index values is also set.

In the example configuration of FIG. 7, individual events occurring at 15:05, 16:25, and 16:35 have event index values of 45, 121, and 30, respectively, and major events occurring at 16:38 are 52 event indexes. Has a value. The above-described configuration is illustrated in table T3 of FIG.

The event index value generated as in the example configuration of FIG. 7 is normalized to input into the deep learning model. For example, since the highest value among the event index values in the illustrated example is 400, each event index value may be normalized to a value ranging from 0 to 1 based on 400. This configuration is illustrated in FIG. 8, where the lower secondary transformed state is normalized.

The input node for the input data of the deep learning model is configured to have the same number as the number of the preceding time division ranges by dividing the preceding time range into a preset number.

In the case of the embodiment of Figure 9, the preceding time range is set to 1 hour and divided into units of 10 seconds to configure 360 input nodes. Each input node inputs the normalized event index value generated at each time point as input data.

The number of hidden layers and the number of nodes between the input node and the output node can be changed according to the monitoring policy.

The output nodes for the output data are configured with the same number as the total number of the individual events (the number of event management items). In the case of the embodiment of FIG. 9, since a total of 100 event management items are provided to monitor a total of 100 individual events, 100 output nodes are configured.

Also, preferably, the output node for the output data may further include at least one dummy node for distinguishing a no-event state in which no major event occurs in the deep learning process.

Referring to FIG. 9, a normalization value of an event index value of 45, 121, and 30 of preceding events is input to an input node corresponding to 15:05, 16:25, and 16:35, and among output nodes 1 to 100. A value '1' to identify that the main event has occurred is assigned to output node 52, which is an event management item of the main event, and all other output nodes are assigned as '0' and input as output data. If dummy node is added at 101, '0' is assigned at 101.

For example, when one preceding event occurs for one minute from 15:05:00 to 15:15:59, the input data value of the preceding event is input to the input node at 15:05:00.

As another example, if two or more preceding events occurred during 1 minute of 15:05:00 to 15:15:59, a total of 6 input nodes are prepared during 1 minute of 15:05:00 to 15:15:59. Therefore, the input data value for each preceding event is input to the plurality of input nodes corresponding to the time range of 15:05:00 to 15:15:59, respectively, according to the event occurrence order.

Referring to the embodiment of FIGS. 6 to 10 from another viewpoint, when the preceding event pattern of the normalized event index value at the bottom of FIG. 8 occurs, it may be understood as a pattern-based deep learning in which the main event of event management item 52 occurs. Can be. By learning this pattern-based deep learning model for each major event included in the time series data, it is possible to predict the occurrence of major events from the patterns of individual events input in real time.

In addition, by learning the occurrence relationship of the major events with respect to the same or similar preceding event pattern, it is possible to calculate the probability of occurrence of the major event pattern when the event pattern occurs.

In this manner, the deep learning model is trained while the time series data is shifted over time, and the time series data for deep learning may be continuously updated according to a preset update period.

In step 5), the monitoring system 20 uses event information of individual events occurring in real time in the work system 10 as input data of the deep learning model and predicts the possibility of major events from the output data of the deep learning model. do.

The preceding event pattern is generated by the individual events occurring in real time, and thus the probability of occurrence of the main event is calculated. Such a main event occurrence probability may be provided to the administrator through a display using various event monitoring UIs (user interface).

In addition, for example, when the case where the main event occurrence probability is 80% or more as an alarm condition, an alarm indication may be provided when a major event that satisfies the condition is predicted.

The monitoring method according to an embodiment of the present invention may be provided as a computer program stored in a medium in combination with hardware to execute the monitoring method, and a computer program for recording the computer program for executing the monitoring method on a computer. It may also be provided included in a readable recording medium.

To this end, embodiments of the present invention include a program for performing various computer-implemented operations and a computer readable recording medium recording the same. The computer readable recording medium may include program instructions, data files, data structures, etc. alone or in combination. The media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer readable recording media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROM, DVD, USB drives, magnetic-optical media such as floppy disks, and ROM, RAM, Hardware devices specifically configured to store and execute program instructions, such as flash memory, are included. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

10: business system
20: monitoring system

Claims (13)

An event monitoring method executed in a monitoring system interworking with a work system, wherein the work system includes a plurality of object elements coupled to each other based on a hierarchical relationship and provides at least one work service. All items and counts for each individual event being preset-,
1) obtaining event information of an individual event occurring in the work system, and storing the event information in the form of time series data based on an occurrence time of the individual event, wherein the event information indicates that the individual event is hierarchically related. Object element information indicating which object element occurred in the and element class information assigned according to the severity state of the individual event;
2) extracting a main event for learning a deep learning model based on a preset extraction criterion from the time series data of the event information, wherein the extraction criterion of the main event is based on the time series data of the event information. Among the included individual events, configured to extract individual events having class information of a predetermined level or more as a main event;
3) extracting, from the time series data of the event information, at least one or more individual events that temporally precede one of the main events on the basis of preset extraction criteria as a preceding event for one of the main events-the preceding event. The extraction criterion of is generated in a preset time range based on the occurrence time of one main event extracted in the step 2) among the individual events included in the time series data of the event information, and the rating information equal to or greater than the preset rating. Configured to extract an individual event with a preceding event for that main event;
4) training a deep learning model using the event information of the preceding event as input data and the event information of the main event as output data, wherein the input data is the object element information and the grade included in the event information of the preceding event. Generating a numerically indexed event index value based on the information and normalizing the event index value, wherein an input node for the input data is equal to the number of preceding time division ranges that divides the preceding time range into a preset number The number of output nodes for the output data is equal to the total number of individual events; And
5) using the event information of the individual events occurring in real time in the work system as input data of the deep learning model and predicting the probability of occurrence of the main event from the output data of the deep learning model; deep learning Event monitoring method based on event prediction using a model.
The method of claim 1,
The hierarchical association is
The event monitoring method based on event prediction using a deep learning model, characterized in that the business system is defined as a tree layer having the highest layer, the object element to the lowest layer.
The method of claim 1,
In step 1),
And the event information is stored in the form of time series data on the basis of a preset period.
delete delete The method of claim 1,
The preceding time range is,
Event monitoring method based on event prediction using a deep learning model, characterized in that set in the time range having a predetermined time interval based on the occurrence time of the main event.
delete delete The method of claim 1,
The output node for the output data, the event monitoring method based on event prediction using a deep learning model, characterized in that further comprises at least one dummy node for distinguishing the no-event state in which no major event occurs .
The method of claim 1,
The object element is an event monitoring method based on event prediction using a deep learning model, characterized in that any one of a physical function element or a logical function element where an individual event occurred.
The method of claim 1,
The deep learning model is an event monitoring method based on event prediction using a deep learning model, characterized in that based on the Long Short Memory Networks (LSTM) architecture.
Memory for storing one or more instructions; And
A processor for executing the one or more instructions stored in the memory;
The processor,
Obtain event information of individual events occurring in a business system, and store the event information in the form of time series data based on the time of occurrence of the individual events-the business system combines a plurality of object elements based on a hierarchical association Configured and providing at least one business service, and the total number and number of individual events to be monitored in the business system are preset, and the event information indicates that the individual event is generated in any object element of the hierarchical relationship. Object element information indicative of whether or not and rating information assigned according to the severity state of the individual event;
Extracting, from the time series data of the event information, a main event for learning a deep learning model based on a predetermined extraction criterion, wherein the extraction criteria of the main event is an individual included in the time series data of the event information. Among the events, configured to extract an individual event having class information of a predetermined level or more as a main event;
Extract, from the time series data of the event information, at least one or more individual events that temporally precede one of the main events as predecessors for one of the main events based on preset extraction criteria; Among the individual events included in the time series data of the event information, an individual event occurring in a preset time range preset based on an occurrence time of one of the main events, and having a class information of a predetermined level or more, corresponds to the corresponding main event. Set to extract as a preceding event for;
The deep learning model is trained using the event information of the preceding event as input data and the event information of the main event as output data, wherein the input data is based on the object element information and the grade information included in the event information of the preceding event. Generate a numerical event index value and normalize the event index value, and the input node for the input data is configured to have the same number as the number of preceding time division ranges that divide the preceding time range into a preset number. The output node for the output data is configured to be equal to the total number of individual events;
And event information of individual events occurring in real time in a work system as input data of a deep learning model, and predicting a probability of occurrence of a major event from output data of the deep learning model.
A computer program stored on the medium in combination with hardware to execute an event monitoring method,
The monitoring method,
Obtaining event information of individual events occurring in a business system, and storing the event information in the form of time series data based on an occurrence time of the individual event, wherein the business system includes a plurality of object elements based on a hierarchical relationship; Combined and configured to provide at least one business service, the total number and the number of individual events to be monitored in the business system is preset, the event information is that the individual events in any object element of the hierarchical association Object element information indicating whether an occurrence has occurred and rating information given according to a severity state of the individual event;
Extracting a main event for learning a deep learning model based on a predetermined extraction criterion from the time series data of the event information, wherein the extraction criterion of the main event is included in the time series data of the event information Among the individual events, configured to extract individual events having class information of a predetermined level or more as a main event;
Extracting, from the time series data of the event information, at least one or more individual events that temporally precede one of the main events as predecessors for one of the main events based on preset extraction criteria—extraction of the preceding events The criterion is an individual event, which occurs in a preset time range preset based on the occurrence time of one main event extracted in the step among the individual events included in the time series data of the event information, and which has class information equal to or higher than the preset level. Is set to extract as a preceding event for that major event;
Training a deep learning model using the event information of the preceding event as input data and the event information of the main event as output data, wherein the input data is based on the object element information and the rating information included in the event information of the preceding event. Generate an indexed event index value based on the normalized event index value and normalize the event index value, and the input node for the input data is equal to the number of the preceding time division ranges which divides the preceding time range into a preset number. Configured to have output nodes for the output data equal to the total number of individual events; And
And using the event information of the individual events occurring in real time in the work system as input data of the deep learning model and predicting the likelihood of occurrence of the major event from the output data of the deep learning model.

Images